CVE-2026-14950CWE-613
CVE-2026-14950
Critical · published August 20, 2026
What it is
An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session after it should have expired. This increases the risk associated with stolen, leaked, shared, or unattended sessions and may enable unauthorized continued access to the FDS web interface.
The record
Technical detail
- CVSS v3.1
- 9.8 · CRITICAL
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v4.0
- 9.2 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS
- 0.00646 · 50.3th percentile
- Weakness
- CWE-613 · Insufficient Session Expiration
- Published
- 2026-08-20T13:16Z
References (1)
EPSS history
Timeline